tapinall LEGAL

LEGAL · EFFECTIVE OCTOBER 13, 2026

Privacy Policy.

What tapinall collects, why, who sees it, and how to reach us about your data.

tapinall, operated by Pawbytes, collects the minimum needed to run a metered API service: your sign-in identity, your usage records, and payment metadata. With your consent we also measure which pages and ads bring people to us. We never store passwords or card numbers. We never sell your data.

  • Account identity. Your email address and identity-provider subject ID, received when you sign in. Passwords and verification live at the hosted identity provider, never with us.
  • Usage records. The tool you called, which token made the call, timestamps, cost figures, and failure status — the meter and the ledger are the product.
  • Payment metadata. Top-up amounts, the payment rail used, and the payment reference. Card, wallet, and bank details are held by our payment partners, not by us.
  • Technical data. IP address (for rate limiting and abuse prevention), browser user-agent, and the signed session cookie that keeps you logged in.
  • Marketing attribution. When you arrive from a link or an ad, the campaign parameters in that link (utm tags and ad click identifiers such as a Google, Meta, or TikTok click ID), the referring site (its address only, such as https://example.com, never the page or its query), the page you landed on, and the time. If you then create an account, this is stored with your account so we can tell which campaigns bring customers. Only if you accepted cookies, when you are signed in we also store your browser user-agent and the browser identifiers held in the analytics and advertising cookies (the Google Analytics client and session IDs and the Meta browser ID), so a later conversion report can be matched to your visit.
  • Measurement data, only with your consent. Page views and product events (for example: a button clicked, an account created, a top-up started) collected through Google Tag Manager and Google Analytics, and through Meta or TikTok tags when we run campaigns there.

Strictly necessary. A signed session cookie (HttpOnly, keeps you signed in), a short-lived sign-in transaction cookie, and tap_consent, which remembers your cookie choice for 180 days. These are always on.

First-party attribution. tap_mkt records how you arrived (campaign parameters, ad click identifiers, the address of the referring site only, landing page, time) for 90 days. It is read only by us. It is never shared on its own: it reaches an advertising partner only as part of a conversion report, and only if you have accepted cookies.

Analytics and advertising, only if you accept. Google Analytics (_ga, _ga_*), the Google Ads conversion linker (_gcl_au, _gcl_aw), and when we run campaigns there, the Meta pixel (_fbp, _fbc) and the TikTok pixel (_ttp). These measure which pages and ads lead to sign-ups and top-ups. Ad click identifiers such as gclid, fbclid, and ttclid arrive as parameters in the link you followed, not as cookies; we keep them in tap_mkt.

How consent works. Analytics and advertising storage defaults to denied everywhere. A banner on our website asks for your choice. Until you accept, these tags do not set or read their cookies; Google may still receive cookieless pings, with nothing stored in your browser, that help it model conversions in aggregate. Your choice is kept for 180 days, and you can change it at any time with the Cookie preferences link in the site footer. The signed-in dashboard follows the choice you made (without one it stays denied), and staff tools carry no marketing tags.

Changing your mind. Your choice also decides whether our servers send conversion reports about you (see Who we share it with). Your choice is kept per browser. If you make or change it while signed in, it applies to those reports straight away. If you make it while signed out, our servers learn it at your next sign-in or top-up from that browser. Signing in or topping up from a browser where you have not chosen counts as no choice: no reports about you are sent until you accept in that browser. Rejecting also removes the analytics and advertising cookies already set in that browser.

  • Run the meter and the ledger — turn calls into balances you can audit.
  • Bill top-ups, post credits, and process refunds through our payment partners.
  • Prevent abuse — rate limits, fraud signals, and AUP enforcement.
  • Send transactional email (receipts, budget alerts, security notices).
  • Meet legal, tax, and accounting obligations.
  • Identity provider — hosts sign-in and holds your credentials.
  • Payment partners — our Indonesian payment gateway for local rails, and a merchant-of-record partner for international cards; they process payment and tax data under their own privacy policies.
  • Transactional email provider — delivers receipts and alerts.
  • Upstream API providers — a catalog call carries the request payload you send plus the technical metadata needed to route and meter it. Provider handling of that traffic is covered by their own terms.
  • Google (Tag Manager, Analytics, Ads) — and Meta and TikTok when we run campaigns on their platforms — receive measurement data only if you accept cookies.

Conversion measurement, only with your consent. If you accepted cookies, our servers tell Google, and Meta and TikTok when we run campaigns there, when you sign up, create your first API token, make your first call, top up, or get a refund, so they can count the conversion. Depending on the partner, each report carries a SHA-256 hash of your lowercased email address (never the email itself), your customer ID, the ad click identifiers from your arrival, your browser identifiers and browser user-agent, and for top-ups and refunds the amount and a payment reference. If you rejected cookies or never chose, no conversion report about you is sent.

We do not sell personal data. Beyond the consent-based conversion measurement described above, we do not share it for third-party advertising or build profiles on you.

Account and usage data is kept while your account is active and as long after as law and honest bookkeeping require — the append-only ledger is our accounting record and is retained accordingly. API tokens are stored only as hashes and stop working when revoked or the account is closed.

Marketing attribution data (ad click identifiers, campaign tags, the referring site and landing page, browser identifiers, and the browser user-agent) is kept with your account on the same terms as other account data. The tap_mkt cookie expires from your browser after 90 days.

Sessions are HMAC-signed HttpOnly cookies, API tokens are stored hashed, secrets live only in the environment, and every crediting path is idempotent. No system is perfectly secure; if something goes wrong we will tell you what we know, plainly.

Email support@tapinall.com to access, correct, export, or delete your personal data. Deletion is subject to what accounting law lets us erase. We answer within a reasonable time.

Our processors may operate in other countries. We rely on their published safeguards and process only what the service needs.

Policy changes are posted here with a new effective date. Questions about your data: support@tapinall.com. tapinall is operated by Pawbytes in Indonesia. Effective October 13, 2026.